CVE-2025-61771

Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, ``Rack::Multipart::Parserstores non-file form fields (parts without afilename) entirely in memory as Ruby Stringobjects. A single large text field in a multipart/form-data request (hundreds of megabytes or more) can consume equivalent process memory, potentially leading to out-of-memory (OOM) conditions and denial of service (DoS). Attackers can send large non-file fields to trigger excessive memory usage. Impact scales with request size and concurrency, potentially leading to worker crashes or severe garbage-collection overhead. All Rack applications processing multipart form submissions are affected. Versions 2.2.19, 3.1.17, and 3.2.2 enforce a reasonable size cap for non-file fields (e.g., 2 MiB). Workarounds include restricting maximum request body size at the web-server or proxy layer (e.g., Nginxclient_max_body_size`) and validating and rejecting unusually large form fields at the application level.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-400"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61771.json"
}

References

Affected packages

Git / github.com/rack/rack

Affected ranges

Type

GIT

Repo

https://github.com/rack/rack

Events

Introduced

Fixed

4c4ea296fdfd115377912aa7dbcb55b83bf2888e

Introduced

606365ba1353cbffdf94422c20166dc2e6d6286d

Fixed

8d141b301dd1eeda363d87d61499fe21dd90f4a5

Introduced

b68251c03788ff39d4a4b25424df7360426e4afd

Fixed

bce149b11154e851c437b5ece1c026c943f4b571

Fixed

589127f4ac8b5cf11cf88fb0cd116ffed4d2181e

Fixed

d869fed663b113b95a74ad53e1b5cae6ab31f29e

Fixed

e08f78c656c9394d6737c022bde087e0f33336fd

Database specific

Show details

{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:rack:rack:*:*:*:*:*:ruby:*:*",
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "2.2.19"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:rack:rack:*:*:*:*:*:ruby:*:*",
            "range": [
                {
                    "introduced": "3.1.0"
                },
                {
                    "fixed": "3.1.17"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:rack:rack:*:*:*:*:*:ruby:*:*",
            "range": [
                {
                    "introduced": "3.2.0"
                },
                {
                    "fixed": "3.2.2"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "range": [
                {
                    "fixed": "589127f4ac8b5cf11cf88fb0cd116ffed4d2181e"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "d869fed663b113b95a74ad53e1b5cae6ab31f29e"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "e08f78c656c9394d6737c022bde087e0f33336fd"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

0.*

0.1

0.2

0.3

1.*

1.0

1.3.0

1.3.0.beta

1.3.0.beta2

1.4.0

1.4.1

1.5.0

1.5.1

1.6.0.beta

2.*

2.0.0

2.0.0.alpha

2.0.0.rc1

2.0.1

2.1.0

2.2.0

2.2.3

2.2.4

v2.*

v2.2.1

v2.2.10

v2.2.11

v2.2.12

v2.2.13

v2.2.14

v2.2.15

v2.2.16

v2.2.17

v2.2.18

v2.2.2

v2.2.5

v2.2.6

v2.2.6.1

v2.2.6.2

v2.2.7

v2.2.8

v2.2.9

v3.*

v3.1.0

v3.1.10

v3.1.11

v3.1.12

v3.1.13

v3.1.14

v3.1.15

v3.1.16

v3.1.2

v3.1.3

v3.1.4

v3.1.5

v3.1.6

v3.1.7

v3.1.8

v3.1.9

v3.2.0

v3.2.1

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-61771.json"